EP3388904A1

EP3388904A1 - Multicore architecture, interface card and method of processing data packets

Info

Publication number: EP3388904A1
Application number: EP17166428.7A
Authority: EP
Inventors: Markus Dr. Dilger; Stefan Dr. Eberli; Daniel Hofer; Michael Meier
Original assignee: Duagon AG
Current assignee: Duagon AG
Priority date: 2017-04-13
Filing date: 2017-04-13
Publication date: 2018-10-17
Anticipated expiration: 2037-04-13
Also published as: EP3388904B1; JP2018181344A; CN108763145A; CN108763145B; JP7160550B2

Abstract

The invention relates to a multicore architecture (1) comprising: a reconfigurable logic device (2); the reconfigurable logic device (2) including a first CPU (3) and a second CPU (4); the first CPU (3) being configured to process safety-related data; and the second CPU (4) being configured to process non-safety-related data only. The invention also relates to a corresponding interface card (13) and to a method of processing data packets.

Description

BACKGROUND

The present invention relates to a multicore architecture for communication purposes. In particular the present invention relates a multicore architecture used within train communication networks (TCN). The TCN is normally built of different communication network options, especially wire train bus (WTB), Ethernet train backbone (ETB), multifunction vehicle bus (MVB), controller area network (CAN-bus) and/or Ethernet (ETH) may be provided. The present invention is used for interconnecting different subsystems within a train communication network enabling these subsystems to communicate together or with each other over the TCN.
A large percentage of the costs for the development of safety-related, new and innovative devices for interconnecting difference subsystems within a TCN are incurred by validation and certification processes.
Every function of a train may be categorized into a distinguished safety integrity level (SIL). The network communication device inherits the SIL of the function it is involved with. The safety integrity level is a measurement of performance that is required for a safety instrumented function (SIF). There are safety integrity levels 0 to 4, whereas in safety integrity level 0 the risk is considered to be low and (almost) no hazard may influence the safety integrity level 0 device. The highest safety integrity level is level 4.
Every application and every device which is involved into a safety function with one of the safety integrity levels 1 to 4 has to be assessed by an assessor. The assessor is independent from the development project. In many cases these assessments or certifications are conducted by an external authority which is time and cost consuming. When the assessment is finished, any amendment to the device or to the processes running on the device have to undergo another new assessment procedure. Hence, also an amendment is time and cost consuming.
Furthermore, regarding railway applications, space is also a critical parameter within train communication networks. This is why space-saving designs for the communication devices are desired. However, interface cards provide flexibility to subsystem manufacturer because they do not have to adopt their systems and protocols to the TCN themselves. Additionally, the maintenance of the systems is simplified.
Therefore it is an object of the present invention to provide a multicore architecture, an interface card and a method which overcome the deficiencies mentioned above.

SUMMARY OF THE INVENTION

The object relating to the multicore architecture is solved by a multicore architecture according to claim 1. Preferred embodiments are mentioned in the dependent claims.
The multicore architecture comprises a reconfigurable logic device which includes a first central processor unit (CPU) and a second central processor unit. The first CPU being configured to process safety-related data and preferably to perform safety-related function. This safety-related functionality and the safety-related data is all data which is categorized at least within one of the safety-integrity levels 1 to 4. The second CPU being configured to process non-safety related data and preferably non-safety-related functions only, whereas this non-safety related data is all data which either has no categorization into one of the safety integrity levels or which belongs to safety integrity level 0. According to an example embodiment the first CPU and/or the second CPU is formed as a reduced instruction set computer (RISC processor). Other processor types, such as CISC etc., are also possible.
Thanks to this multicore architecture it is now possible to update the application (firmware) of the non-safety second CPU without undergoing a further certification. This is possible because the application of the safety first CPU remains untouched. In conventional architectures, the entire functionality is covered by a single CPU or it is on single CPUs each implemented in a different logic device such as an ASIC. The present invention instantiates multiple CPUs inside the same reconfigurable logic device.
In one embodiment the reconfigurable logic device is formed as a field programmable gate array (FPGA). Thereby an updatable multicore architecture for (railway) safety-related application is provided, which, in addition, provides a very space-saving design. The application firmware of the second CPU may be updated and/or another application may be implemented therein. Since this second CPU is used to process non-safety-related data only, another (new) assessment or certification process is not necessary.
In another example, the multicore architecture is characterized in that an interprocessor communication device is provided for linking the first CPU to the second CPU and being configured to block interference and/or disturbance of the processes running on the first CPU by the processes of the second CPU, the interprocessor communication device preferably enabling information transfer between the first CPU and the second CPU, whereas the information transfer is preferably bi-directional. The interprocessor communication device is preferably implemented on the reconfigurable logic device itself and serves as a kind of a firewall, especially as a hardware firewall. The interprocessor communication device ensures, that the second CPU cannot interfere and/or disturb the operation of the first CPU.
Preferably, the multicore architecture provides a digital interface module being configured to at least indirectly connect one or more peripheral devices to the first CPU and/or the second CPU. In one preferred embodiment the digital interface module is implemented onto or within the reconfigurable logic device which provides an even more space-saving layout.
Additionally it is preferred, that a network interface module is provided which is configured to at least indirectly connect one or more network devices to the first CPU and/or the second CPU. In a preferred embodiment, the network interface module is implemented onto or within the reconfigurable logic device. Via this network interface module the multicore architecture may communicate with the TCN, e.g. via an Ethernet.
In one embodiment the network interface module may be formed as or may be connected to a multiport, preferably as a three-port, Ethernet switch.
In yet another example of a multicore architecture, a data splitting device is provided. The data splitting device is preferably implemented onto or within the reconfigurable logic device and the data splitting device is configured to split data into the safety-related data (data comprising safety integrity levels 1 to 4) and into the non-safety-related data (data comprising safety integrity level 0 or less). The data splitting device ensures, that only the non-safety-related data with safety integrity level 0 or less is directed to the second CPU. Every data packet having a safety integrity level of 1 or more is sent to the first CPU.
To ensure a safe and complete transmission of processed data packets to a host device, a host interface is provided in yet another embodiment. This host interface is at least indirectly connected to the first CPU and/or the second CPU for transmitting processed data packets to a host device. The host device may comprise a host driver enabling a host application running on a microprocessor of the host to communicate with the multicore architecture and thus with the overall TCN. The host application can be, for example, a door control application, a window control application, an on-train climate control application, etc.
In yet another embodiment of the multicore architecture, a first real time operating system is running on the first CPU and the second real time operating system is running on the second CPU. Additionally the first CPU many run a first embedded application relating to data with safety integrity levels 1 to 4, whereas a second embedded application may be running on the second CPU processing non-safety-related data with safety integrity level 0 or less.
To provide an (at least partially) updatable system, in one example, the second CPU is configured to be reprogrammable. Therefore, in yet another example, the reconfigurable logic device includes a memory (preferably a flash memory). On this memory, both types of data, the safety-related data and the non-safety-related data may be stored. There may also two different memories included in the reconfigurable logic device, whereas one of them stores the safety-related data and the other stores the non-safety-related data. In either case only the part of the memory (flash) image is updateable which concerns the non-safety-related data, functions or programs. Thus, it is possible to update or reprogram the embedded application of the second CPU and/or the second real time operating system. Changes or amendments to the second CPU which are related to non-safety-related data or devices are therefore performed in an easy way without the need for a reassessment or recertification of the whole multicore architecture for railway purposes. In another embodiment, an additional or separate programming port may be provided for reprogramming and/or updating the second CPU.
The object relating to the method is solved by the method according to claim 11. Preferred embodiments are mentioned in the dependent claims.
The invention relates to a method of processing data packets comprising one or more safety-related data packets and one or more non-safety-related packets, the method comprising the steps of:

Providing a multicore architecture with a reconfigurable logic device which includes a first CPU and a second CPU;
Splitting the one or more safety-related data packets from the non-safety-related data packets by a data splitting device;
Processing the safety-related data packets in the first CPU, which is configured to process the safety-related data thereby producing processed safety-related data packets; and
Processing the one or more non-safety-related data packets in a second CPU which is configured to process non-safety-related data only, thereby producing one or more processed non-safety-related data packets.

Of course, more than only one first CPU and/or more than only one second CPU may be included within the reconficurable logic device. To protect data packets from corruption, (between the first CPU and any host application running on a host device) during processing the one or more safety-related data packets a safety layer is included to the one or more processed safety-related data packets. This safety layer adds a checksum and/or other information to the processed safety-related data packets thereby enabling the host device to detect if a data packet is intact or not. The host device therefore includes a corresponding checking device or application functionality.
Furthermore, according to another embodiment, the additional following step is included:

Transmitting the processed safety-related data packets to a host device or host system preferably using a (multi channel) host interface. The host interface preferably including one or more safety channels for transmitting the processed safety-related data packets and one or more non-safety channels for transmitting the processed non-safety related data packets.

For updating a firmware, a second real time operating system or a second embedded application within the second CPU and thereby to form an updatable multicore architecture, the additional following step is included:

Providing a programming port being configured to communicate at least with the second CPU; and
Updating of a firmware and/or a second real time operating system or embedded application within the second CPU via the programming port, preferably without affecting processes running on the first CPU.

Therefore, it is possible to update the firmware and/or the second real time operating system or embedded application (which are preferably stored to a flash memory of the FPGA), when the whole system is running and/or when the whole system is not running.
The object relating to the interface card is solved by an interface card according to claim 15. This interface card is configured to link a host device to a communication network. The interface card comprises a multicore architecture with a reconfigurable logic device including a first CPU and one or more second CPUs. The first CPU being configured to process safety-related data and the one or more second CPUs being configured to process non-safety-related data only.
Other variations of the multicore architecture, the method of processing data packets and the interface card will become more apparent in the light of the following detailed description of exemplary embodiments, as illustrated in the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

Fig. 1: shows a simplified plan view of a multicore architecture according to a first illustrative embodiment,
Fig. 2: shows a simplified plan view of a second illustrative embodiment of a multicore architecture,
Fig. 3a: is a simplified plan view of a first CPU used within a multicore architecture according to fig. 1 or fig. 2,
Fig. 3b: is a simplified plan view of a second CPU used within a multicore architecture according to fig. 1 or fig. 2, and
Fig. 4: shows a simplified plan view of an interface card comprising the multicore architecture of fig. 2 in connection with a host device.

DETAILED DESCRIPTION

Referring now to fig. 1, a multicore architecture 1 comprises a reconfigurable logic device 2. In this embodiment the reconfigurable logic device 2 is formed as a field programmable gate array, FPGA 2a. The FPGA 2a includes a first CPU 3 and a second CPU 4. Both CPUs 3, 4 may be formed as a microcontroller, especially comprising a RISC processor. The first CPU 3 is configured to process safety-related data, whereas the second CPU 4 is configured to process only non-safety-related data. Of course more than only one first CPU 3 may be implemented within or onto the FPGA 2a. It is also possible to include or implement more than only one second CPU 4 within or onto the FPGA 2a.
The multicore architecture 1 includes a digital interface module 6 which is configured to at least indirectly connect one or more peripheral or host devices 11 via a host interface 10 to the reconfigurable logic device 2. In the present case, data packets processed by first CPU 3 and data packets processed by the second CPU 4 may be directed to the peripheral devices, e.g. to the host devices 11.
In the illustrative embodiment, the digital interface module 6 is implemented onto or within the reconfigurable logic device 2, i.e. the FPGA 2a. This digital interface module 6, in one example, may be formed as a FIFO, as a dual port RAM, etc.. The digital interface module 6 comprises a number of channels 14 that corresponds to the number of CPUs 3, 4 implemented onto or within the FPGA 2a. In the present embodiment, two channels 14 are provided within the digital interface module 6, a first channel 14a for transmitting safety-related data to the host device 11 via the host interface 10 and a second channel 14b for transmitting non-safety-related data. Additional channels 14 are possible, too.
The multicore architecture 1 further includes a network interface module 7 which, in the present example, is also implemented within or onto the reconfigurable logic device 2, i.e. the FPGA 2a. This network interface module 7 is configured to at least indirectly connect one or more network devices to the first CPU 3 and/or the second CPU 4. The network interface module 7 may be formed as or may be configured to be connected to a multiport, especially as a three-port Ethernet switch 8. A different number of ports is possible. The network interface module 7 comprises a first input 15a and a second input 15b that are connected to a output port 16 comprising a filtering device 16a. Alternatively or additionally a buffering device 16b is also included within the network interface module 7. This network interface module 7 with its filtering device 16a is formed as a data splitting device 9 configured to split data into the safety-related data and into the non-safety-related data. It is also possible to form the data splitting device 9 separately from the network interface module 7. Beyond the data splitting device 9 the safety-related data is transmitted to the first CPU 3 for further processing. The non-safety-related data is transmitted to the second CPU 4 for further processing.
Referring now to fig. 2, another embodiment of a multicore architecture 1 is shown. This multicore architecture 1 differs from that one in fig. 1 in that an interprocessor communication device 5 is provided. This interprocessor communication device 5 links the first CPU 3 to the second CPU 4 and is configured to block interference and/or disturbance of the processes running on the first CPU 3 by the processes of the second CPU 4. The example interprocessor communication device 5 enables the communication between the processors, but blocks their interference. The interprocessor communication device 5 is configured to grant access to the data of or on the second CPU 4, but it is configured to deny access to the data of or on the first CPU 3. Or, in other words, the first CPU 3 may access to the data on the second CPU 4, but not the other way round. This interprocessor communication device 5 is also implemented onto or within the reconfigurable logic device 2 and serves merely as a (hardware) firewall between the two or more CPUs 3, 4.
A detailed schematic view on the first CPU 3 is discussed with reference to fig. 3a. The first CPU 3 is configured to run a first real time operating system 18a (RTOS) and comprises a first network communication unit 19a. A first RTOS is not mandatory, but preferred. Furthermore, the first CPU 3 comprises a unit 20a where a safety-related application is running and carried out. This safety-related application processes the safety-related data packets which may be further processed in an encryption unit 21 a of first CPU 3. Within this encryption unit 21 a a safety layer 22 may be included to the processed safety-related data packets before they are transmitted to the host device 11.
The second CPU 4, according to one example of the present invention, is described with reference to fig. 3b. The second CPU 4 differs from the first CPU 3 in fig. 3a in that no safety-related application is provided. The second CPU 4 instead uses a unit 20b with a non-safety-related application for processing the non-safety-related data. Therefore, it is not possible to process data packets which are categorized into any of safety integrity levels 1 to 4. The illustrative second CPU 4 also has an encryption unit 21 b, but this unit 21 b may be omitted, since it is not necessary to include a safety layer 22 to the processed non-safety-related data packets. A second RTOS is not mandatory, but preferred.
Reference is made to fig. 4 showing an interface card 13 being wired or wirelessly connected to a host device 11. The exemplary interface card 13 comprises the multicore architecture 1 according to the embodiment shown in fig. 2. The interface card 13 further provides a memory 23 being connected to the reconfigurable logic device 2, i.e. the FPGA 2a. Other components 24 may be connected to the FPGA 2a, too.
A method of processing data packets comprising one or more safety-related data packets will be described in the following.
Data packets comprising one or more safety-related data packets and one or more non-safety-related data packets are sent from a network, e.g. a train communication network to the first input 15a and/or the second input 15b of the network interface module 7, which in the exemplary embodiments, is a three-port Ethernet switch 8. The data packets are split into one or more safety-related data packets and into one or more non-safety-related data packets by the data splitting device 9 which in the preferred embodiment is formed as a filtering device 16a.
The safety-related data packets are sent via line 25 to the first CPU 3 being processed there. The non-safety-related data is transmitted via line 26 to the second CPU 4 being processed there. The interprocessor communication device 5 ensures, that the processing of the non-safety-related data within the second CPU 4 does not interfere the processes running on the first CPU 3. The first CPU 3 processes safety-related data packets and the second CPU 4 processes non-safety-related data packets. Additionally, within the first encryption unit 21a of the first CPU 3 a safety layer 22 is included to the one or more processed safety-related data packets. The processed safety-related data packets are transmitted via line 27 to the digital interface module 6, which, in the present embodiment, is a two channel 14 digital interface module 6. Via line 28 the processed non-safety-related data is also transmitted to the digital interface module 6.
This digital interface module 6 enables transmission of the processed safety-related data packets to the host device 11, especially to a host driver 29. The host driver 29 enables communication with the multicore architecture 1 and therefore with the interface card 13. Usually the host device 11 also comprises an operating system layer which is needed to adapt the host driver 29 to the host target platform and, if present, the host operating system. Within the host driver 29 a decryption unit 30 is provided, that is configured to check, if the safety layer 22 is correct and if the processed safety-related data packet is intact or not. Accordingly the processed non-safety-related data packets are also received by the host device 11 without searching or checking for a safety layer 22. Within the host device 11 the host application 31 processes the data packets coming from the TCN via the multicore architecture 1. Within the host application 31 a typical control application may be running, e.g. a door control application on the train.
With the present invention it is possible to update the second real time operating system 18b within or running on the second CPU. Also the non-safety-related application 20b may be upgraded or replaced. Therefore the switch 8 may act as a programming port 12 being configured to communicate with the second CPU 4. Via this programming port 12 the firmware and/or the second real time operating system within the second CPU 4 may be changed, updated or replaced. By use of the interprocessor communication device 5 this updating, changing or replacing is conducted without affecting processes running on the first CPU 3. In yet another embodiment, the new application/firmware is loaded into a memory (23a) of the FPGA 2a via the switch 8. Afterwards the new application/firmware is installed with the help of the first CPU 3 via the interprocessor communication device 5 onto the second CPU 4. A reboot of the reconfigurable logic device 2 may be necessary afterwards.
Programming of the interface card 13 may be performed via an Ethernet-port as described above, via a special (hardware) programming plug, or via the host interface 10 and/or the digital interface module 6.
The preceding description is exemplary rather than limiting in nature. Variations and modifications to the disclosed examples may be apparent to those skilled in the art. They do not necessarily depart from the essence of this invention.

LIST OF REFERENCES

1: multicore architecture
2: reconfigurable logic device
2a: FPGA (field programmable gate array)
3: first CPU (central processor unit / first microprocessor)
4: second CPU (central processor unit / second microprocessor)
5: interprocessor communication device
6: digital interface module (for peripheral; e.g. for host device)
7: network interface module (for network; e.g. for TCN devices)
8: switch
9: data splitting device
10: host interface
11: host device
12: programming port
13: interface card
14: channel
14a: first channel (safety-related data channel)
14b: second channel (non-safety-related data channel)
15a: first input
15b: second input
16: output port
16a: filtering device
16b: buffering device (for incoming data from TCN)
17: board (e.g. printed board)
18a: first real time operating system
18b: second real time operating system
19a: first network communication unit
19b: second network communication unit
20a: unit with safety-related application
20b: unit with non-safety-related application
21a: encryption unit (first CPU)
21b: encryption unit (second CPU)
22: safety layer
22*: safety layer
23: memory
23a: memory (e.g. flash)
24: component
25: line
26: line
27: line
28: line
29: host driver
30: decryption unit
31: host application (unit)

Claims

A multicore architecture (1) comprising:
a reconfigurable logic device (2);

the reconfigurable logic device (2) including a first CPU (3) and a second CPU (4);

the first CPU (3) being configured to process safety-related data; and

the second CPU (4) being configured to process non-safety-related data only.
The multicore architecture (1) according to claim 1, characterized in that
the reconfigurable logic device (2) is formed as a field programmable gate array (2a).
The multicore architecture (1) according to claim 1 or 2, characterized in that an interprocessor communication device (5) is provided for linking
the first CPU (3) to the second CPU (4) and being configured to block interference and/or disturbance of the processes running on the first CPU (3) by the processes of the second CPU (4).
The multicore architecture (1) according to any of claims 1 to 3, characterized in that a digital interface module (6) is provided, the digital interface module (6) being configured to at least indirectly connect one or more peripheral devices to the first CPU (3) and/or the second CPU (4).
The multicore architecture (1) according to any of claims 1 to 4, characterized in that a network interface module (7) is provided the network interface module (7) being configured to at least indirectly connect one or more network devices to the first CPU (3) and/or the second CPU (4).
The multicore architecture (1) according to claim 5, characterized in that the network interface module (7) is formed as a multiport, preferably as a three-port, Ethernet switch (8).
The multicore architecture (1) according to any of claims 1 to 6, characterized in that a data splitting device (9) is provided,
the data splitting device (9) being configured to split data into the safety-related data and into the non-safety-related data.
The multicore architecture (1) according to any of claims 1 to 7, characterized in that a host interface (10) is provided connected at least indirectly to the first CPU (3) and/or the second CPU (4) for transmitting processed data packets to a host device (11).
The multicore architecture (1) according to any of claims 1 to 8, characterized in that a first real time operating system is running on the first CPU (3), and a second real time operating system is running on the second CPU (4).
The multicore architecture (1) according to any of claims 1 to 9, characterized in that the second CPU (4) is configured to be reprogrammable, whereas the reconfigurable logic device (2) includes a memory (23a) on which at least the non-safety-related data may be stored.
A Method of processing data packets comprising one or more safety-related data packets and one or more non-safety-related data packets, comprising the steps of:
providing a multicore architecture (1) according to any of claims 1 to 10;

splitting the one or more safety-related data packets from the non-safety-related data packets by a data splitting device (9);

processing the safety-related data packets in a first CPU (3) which is configured to process the safety-related data thereby producing processed safety-related data packets; and

processing the one or more non-safety-related data packets in a second CPU (4) which is configured to process non-safety-related data only, thereby producing one or more processed non-safety-related data packets.
The method of claim 11, characterized in that during processing the one or more safety-related data packets, including a safety layer to the one or more processed safety-related data packets.
The method of claim 11 or 12, further including the step of:
transmitting the processed safety-related data packets to a host device (11) or a host system.
The method of any of claims 11 to 13, further comprising:
providing a programming port (12) being configured to communicate with the second CPU (4); and

updating of a firmware and/or a second real time operating system within the second CPU (4) via programming port.
Interface card (13) configured to link a host device (11) to a communication network, the interface card (13) comprising a multicore architecture (1) according to any of claims 1 to 11.